Can't find sincedb or successfully start Logstash as a service.
- Dominant language
- Java
- Stars
- 14.9k
- Forks
- 3.5k
- Avg merge
- 19h 14m
- Merged PRs (30d)
- 63
Description
Setup:
I'm on a clean install of CentOS7 minimal, and I've installed logstash 1.5 and elasticsearch1.44 via yum
Problem:
Logstash won't index data from /var/log/mylogs without it being started manually at command line. No errors are present in logstash.err, no data in logstash.log to help, and nothing in ES logs.
I thought this was interesting (saved from console of logstash on manual start):
{:timestamp=>"2015-10-21T08:57:56.694000-0400", :message=>"No sincedb_path set, generating one based on the file path", :sincedb_path=>"/root/.sincedb_8f309eb34476af59efaabf28f6aac73a", :path=>["/var/log/python_apps/_.log", "/var/log/python_apps/_.log.*"], :level=>:info, :file=>"logstash/inputs/file.rb", :line=>"120", :method=>"register"}
But, I can't find .sincedb, on my box, at all (tried various forms, checked all home folders, find, locate, ls -a | less, etc). I'm also told that because logstash may be starting as something other than user logstash, that might be the cause. But, /etc/init.d/logstash:
LS_USER=logstash
LS_GROUP=logstash
And, that I doubt that would explain the console output?
I'm out of ideas why logstash can't init correctly and has to be started manually, instead of as a service "systemctl start elasticsearch.service"
Bug? My fault? Need more docs / data?
Thanks for your time.
(Please give me up to 24 hours to reply. This is for work, I don't have remote, and it's super frustrating trying to reply to a thread that's been closed prematurely.)
Contributor guide
Assessment
This issue has not been assessed yet.